Conventionally, clocks of different frequencies are used in a single semiconductor integrated circuit due to increased functional complexity and/or to reduce power consumption of the semiconductor integrated circuit. Circuit blocks in a semiconductor integrated circuit are partitioned according to clock source, into groups each of which is called a “clock domain.” A signal may be transmitted between the clock domains (hereinafter, “clock domain crossing (CDC)”).
FIG. 47 is a diagram of an example of CDC. In FIG. 47, S1 output from a flip flop (FF) in one clock domain is input to an FF in another clock domain. The FF in one clock domain operates in synchronization with CLK1, and the FF(s) in the other clock domain operates in synchronization with CLK2. Data transmitted from the FF in one clock domain to the FF in the other clock domain are input to the FF in the other clock domain irrespective of the clock timing of the FF in the other clock domain.
A metastable state occurs if the setup time and the hold time defined for each FF are violated. The metastable state is a state in which the output is unstable and whether 0 or 1 is output is unclear. If S1 output from the FF in one clock domain changes around the rise of CLK2, the setup time or the hold time of the FF in the other clock domain may be violated as depicted in the chart, thereby bringing S2 output from the FF in the other clock domain into the metastable state.
The effect of the metastable state may be propagated to subsequent FFs and/or combination circuits as a difference in logic value, thereby causing a malfunction of the semiconductor integrated circuit. Thus, the semiconductor integrated circuit needs to be verified not to malfunction even when the metastable state occurs. However, the effect of the metastable state is not considered in a logic verification using a normal FF model.
FIG. 48 is a diagram of an example of a result of simulation using a normal FF model. In verification using the normal FF model, the value of S1 at the rise of CLK2 is output to S2 even when S1 changes around the rise of CLK2, and the effect of violation cannot be verified even when the setup time and/or the hold time are violated. Thus, the model of the FF that receives data transmitted from one clock domain to the receiving clock domain is changed to a model that simulates the effect of the metastable state (hereinafter, “CDC model”) to perform a verification.
FIG. 49 is a diagram of an example of a result of simulation using the CDC model. In verification using the CDC model, a random value (0 or 1) is output as S2 at the rise of CLK2 for one clock cycle if S1 changes around the rise of CLK2. Here, a random value output for one clock cycle is called “CDC jitter”.
FIG. 50 is a diagram of an example of the CDC model depicted in FIG. 49. The CDC model depicted in FIG. 50 describes an operation of detecting a change in an input signal and outputting the random value during the period of a clock event if the clock event occurs within a given time period from the detection of the change. The CDC model includes a jitter detector, a first FF, a second FF, and a selection circuit. The selection circuit outputs a signal output from the first FF if a signal output from the second FF is 0, and outputs $random if the signal output from the second FF is 1. $random indicates a random value is generated. The jitter detector detects the change in the value of the input signal, and outputs 1 for a given time period from the detection of the change. A detailed example of the jitter detector is described later.
FIG. 51 is a flowchart of CDC verification. A computer capable of a logic simulation executes a CDC simulation (step S5101), and determines whether a logic failure (hereinafter, “error”) is detected (step S5102). Coverage data are generated in the CDC simulation, of which details are described later.
If the computer determines an error is detected (step S5102: YES), after a manual debugging by a verifier (step S5103), the computer executes a CDC simulation (step S5101) using circuit data after the debugging. The debugging includes an analysis on the cause of the logic failure (hereinafter, “cause of error”) and/or a correction of logic.
If the computer determines no error is detected (step S5102: NO), the verifier determines whether the coverage is insufficient using the coverage data (step S5104). If the verifier determines the coverage is insufficient (step S5104: YES), the verifier changes conditions for execution (step S5105), and the process returns to step S5101. Here, the change of the conditions for execution includes changing a random sequence and/or an input pattern. If the verifier determines the coverage is sufficient (step S5104: NO), the CDC verification ends.
The cause of failure (the cause of error) is difficult to analyze in the simulation using the CDC model (the CDC simulation) since the simulation result includes the effect of the metastable state. Thus, the verifier performs a normal logic simulation before the change to the CDC model to confirm normal functions include no problem, and then performs a CDC simulation using the same input pattern used in the normal logic simulation to check whether there is any problem due to the effect of the metastable state.
As a standard for coverage determination in CDC, a technology is known that determines, using a result of an execution of normal CDC simulation, whether the coverage is insufficient based on whether the effect of CDC jitter appears at an output terminal. As a standard, a technology is also known that determines whether the coverage is insufficient by identifying whether the effect appears at a point several stages downstream of the CDC model (here, one stage is from the output of an FF to a next FF).
FIG. 52 is a diagram of an example of conventional coverage data. Coverage data 5201 are data concerning the site of occurrence and the number of occurrences. If the site of occurrence is an output terminal, the name of the output terminal is described in the coverage data 5201 as the site of occurrence. If a value different from an expected value is output from the output terminal for 4 times, 4 is described in the coverage data 5201 as the number of occurrences. Coverage data 5202 are data concerning the observed signal and the number of observations. The observed signal is a change in the output of a given CDC model, and the number of observations is the number of times that the effect of the change is observed at an observation point (see, for example, Japanese Laid-Open Patent Publication Nos. 2009-187344 and 2010-176486).
The cause of error in the CDC simulation is a CDC point where data are transmitted from an FF of a first clock domain to an FF of a second clock domain. The source of an error and the point at which the error is determined are distant from each other due to FFs and combination circuits therebetween, and time is required for output. For example, 2^(N) (N=the number of occurrences of CDC jitter and “^” indicates an exponent) simulations are required to cover all combinations of CDC jitter, thereby requiring time for the simulations. Further, if not all combinations of CDC jitter are simulated, only combinations arbitrarily selected by the verifier during manual debugging are simulated, thereby requiring time for an analysis on the cause of error.
Conventionally, it is determined whether the effect of CDC jitter appears at an output terminal and/or an observation point downstream of the CDC model. However, it cannot be determined which CDC point is under test since there are many CDC points upstream of the observation point.